From 28cf9faf77b1ec7ecb028b5c60f8586e1604596a Mon Sep 17 00:00:00 2001
From: Niklas Ye <niklas.ye@enokinetwork.com>
Date: Fri, 31 Jul 2026 07:23:14 +0200
Subject: [PATCH] Gate the release on vet and tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI only ever built and published. The 44 tests in internal/api ran on a
laptop or not at all, so a tag could publish binaries, a container image
and a Helm chart from a commit whose tests had never been run — and the
tests are the only thing holding several documented contracts in place,
including the received_at heartbeat and the alert ordering guard.

A test job now runs go vet and go test, and build, docker and chart all
depend on it. The release job is downstream of build, so a tag that fails
publishes nothing at all rather than publishing three artifacts out of
four.

chart-release.yml is deliberately left alone. It fires on charts/**
pushes and publishes the chart, which contains no Go code and only
references an image tag rather than building one, so gating it on the Go
suite would add a minute to every chart edit for no signal.

This still only runs at release time; nothing checks a push or a pull
request, so a broken commit stays green until somebody tags it.
---
 .github/workflows/release.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index befedbd..e969c93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,25 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Gates every publishing job below. A tag that fails here publishes nothing:
+  # the binaries, the image and the chart are all downstream of it.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
   build:
+    needs: test
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -44,6 +62,7 @@ jobs:
           path: terdut-${{ github.ref_name }}-${{ matrix.goos }}-${{ matrix.goarch }}
 
   docker:
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -76,6 +95,7 @@ jobs:
             ghcr.io/yeniklas/terdut-server:${{ github.ref_name }}
 
   chart:
+    needs: test
     runs-on: ubuntu-latest
     permissions:
       contents: write